The Gentlemen: a ransomware brand that grew sixfold by paying affiliates 90%

Unit 42 profiled a ransomware-as-a-service operation that claimed around 580 victims across 77 countries in under a year. The growth driver is commercial rather than technical — a 90% affiliate split against an industry norm of 70 to 80.

At a glance

Affected

Internet-facing Fortinet, Erlang/OTP and Windows SMB estates; ESXi hosts reachable over SSH; manufacturing most heavily represented among victims.

Impact

EDR agents disabled by a purpose-built framework, shadow copies destroyed, then encryption across Windows and ESXi with double extortion.

Action

Patch the named CVEs, enable EDR tamper protection and alert on agent-stop events, restrict SSH to ESXi hosts, and alert on shadow-copy deletion commands.

Client status

Tamper protection and agent-health alerting are enabled by default across all managed Acronis estates. Silenced agents raise a ticket rather than going unnoticed.

Report an incident

Detail

The Gentlemen appeared around September 2025. By 7 July 2026 Unit 42 counted roughly 580 claimed victims across 77 countries on the group's leak site, with manufacturing the worst-hit sector at 103. Claimed victims rose a little over sixfold comparing the second half of 2025 with the first half of 2026, peaking at 117 in June. Comparitech logged 135 attacks attributed to the group in July alone — 17% of all 799 ransomware attacks it recorded that month.

The interesting variable is the business model

The group pays affiliates 90% of proceeds. Most ransomware-as-a-service programmes pay 70 to 80. That difference is enough to pull experienced affiliates away from established brands, and the victim curve tracks it. It is a reminder that the ransomware ecosystem responds to commercial incentives in the same way any other market does, and that a sudden volume spike often has a pricing explanation rather than a technical one.

Tradecraft: edge exploitation, then agent removal

Initial access is mostly internet-facing exploitation — CVE-2024-55591 in Fortinet FortiOS and FortiProxy, CVE-2025-32433 in Erlang/OTP SSH, CVE-2025-33073 in the Windows SMB client, and CVE-2025-55182 (React2Shell) — supplemented by brute force, stolen credentials and access brokers. Lateral movement uses SMB with self-propagating capability and a custom Go backdoor. ESXi hosts are reached over SSH.

Defence evasion is the part that deserves attention. The group runs its own EDR-killer framework, which Unit 42 tracks as GentleKiller, and is suspected of holding zero-days against endpoint agents. Then vssadmin and wmic destroy volume shadow copies before encryption.

What this means for your recovery design

Shadow copies are reliably destroyed in these intrusions, so they are not a recovery tier — they are a convenience feature that survives ordinary accidents and not deliberate ones. Real recovery has to sit off the Windows domain, on separate credentials, with immutability enforced by the repository rather than by the backup server.

On the endpoint side, the single highest-value detection is an EDR agent going quiet. If GentleKiller's entire purpose is removing your agent, then an agent that stops reporting should page a human, not appear in a weekly health report.

If you find evidence of this activity, do not begin remediation before preserving evidence — console and appliance audit logs are frequently short-retention and will roll off. Acronis MDR provides around-the-clock detection and response for covered estates; otherwise reach us through the contact page and we will advise on preservation before containment.

Sources

Cybernalyst's analysis and recommendations are our own. The underlying research is credited below — please read the original reporting.

No Manners Here: The Ruthless Rise of The Gentlemen RansomwareMatt Brady·Palo Alto Networks Unit 42·10 July 2026
Ransomware Surges in July After Q2 LullJames Coker·Infosecurity Magazine·7 August 2026
Ransomware roundup: July 2026Rebecca Moody·Comparitech·5 August 2026

← All advisories